PRIVACY POLICY
HIFILAT SmartAudio Manager
Version 1.1 · In effect since: May 2026
Last updated: June 2026 (updated for Chile's Law No. 21.719)
EXECUTIVE SUMMARY (TL;DR)
HIFILAT SmartAudio Manager runs 100% on your computer.
We do not collect data. We have no servers. We have no user accounts. Your music never leaves your disk.
The only network connections the app makes are voluntary queries to MusicBrainz (metadata) and LRCLIB (lyrics), and only when you request that information. You control when and for what. In addition, on launch it checks anonymously whether a new version exists (without sending any of your data; can be turned off in Settings).
1. INTRODUCTION
This Privacy Policy describes how HIFILAT SpA ("HIFILAT", "we") handles data related to the use of the SmartAudio Manager software (hereinafter, "the Software").
This policy aligns with the principles established in:
- Law No. 19.628 on the Protection of Private Life (Chile) and Law No. 21.719 on the Protection of Personal Data (Chile; in force as of December 1, 2026), which reforms it
- General Data Protection Regulation (RGPD/GDPR — EU Regulation 2016/679)
- California Consumer Privacy Act (CCPA, where applicable)
2. GUIDING PRINCIPLES
HIFILAT is committed to the following principles:
- Data minimization: only strictly necessary data is processed
- Locality: processing occurs exclusively on the user's device
- Transparency: we document every network interaction
- User control: you decide what data to send to external services
- No commercialization: we do not sell, rent, or transfer data to third parties
3. DATA CONTROLLER
- Legal name: HIFILAT SpA
- RUT: 78.449.278-8
- Address: Antonio Bellet 193, Oficina 1210, Providencia, Santiago, Chile
- Website: https://hifilat.com
- Contact email: contacto@hifilat.com
- Jurisdiction: Republic of Chile
4. DATA THE SOFTWARE PROCESSES LOCALLY
The following data is processed only on your computer and is never transmitted to HIFILAT or to any server:
| Category | Examples | Storage |
|---|---|---|
| Audio files | FLAC, AIFF, MP3, AAC | In the folders you choose |
| Audio metadata | Title, artist, album, year, genre, cover art | Inside the files (tags) |
| Lyrics | Synced (.lrc) or embedded | In .lrc files alongside or in tags |
| Settings | Library folders, defaults, language | config.json in the app's data folder (macOS: ~/Library/Application Support/HIFILAT/SmartAudio/; Windows: %APPDATA%\HIFILAT\SmartAudio\) |
| License | Activation key | license.key in the same app data folder |
| Logs | Application events | hifilat.log in the same app data folder |
| Trial counter | Number of songs used in the usage-based trial (no personal data) | trial.json in the same app data folder |
| Metadata cache | Pre-processed FLAC metadata (speeds up startup) | library_index.db (SQLite) in the app data folder, plus an in-RAM cache during execution; it regenerates itself if deleted |
HIFILAT has no access to this data. It is not synced, not backed up, not transmitted.
4.1 Personal data that may become embedded or that you export
- Digitizer name (CD Ripper): when you rip a CD, the name you provide is written permanently inside each FLAC file (the
HIFILAT_DIGITIZERtag and theHIFILAT_SIGNATURE) to record the origin of the rip. If you use your real name and later share that file, that data travels with it. You choose what name to use. - Diagnostic report (optional): if you generate it for support, a text file is created on your Desktop. It excludes your license, your email, and the contents of your files, but it may include the last lines of the log (which can contain file paths or names). It is not transmitted on its own: it is sent only if you choose to send it to us.
5. DATA SENT TO EXTERNAL SERVICES
The Software makes outbound network connections only when you explicitly request an action that requires it (the only exception is the update check, §5.3: automatic but anonymous and able to be turned off):
5.1 MusicBrainz (https://musicbrainz.org)
When it connects:
- When pressing "Search metadata" in the edit modal
- When detecting a physical CD (lookup by disc-id)
What is sent:
- Title and artist of the song (or the CD's disc-id)
- A User-Agent with a contact email required by MusicBrainz's policy. By default a non-routable anonymous identifier is sent (
anonymous@hifilat.local); an email of yours is sent only if you configure it in Settings → Advanced → Email for MusicBrainz - Your IP address (visible to MusicBrainz like any web request)
What is NOT sent:
- Your audio files
- Your complete library
- Additional personal information
- Identifiers of your device
MusicBrainz privacy policy: https://metabrainz.org/privacy
5.2 LRCLIB (https://lrclib.net)
When it connects:
- When pressing "Search lyrics" in the Lyrics tab of the metadata modal
What is sent:
- Artist, song title, album, and duration
- The application's User-Agent
- Your IP address
What is NOT sent:
- Audio files
- Other metadata
5.3 Update check (the only automatic connection)
When it connects:
- On launching the application, if the option is enabled (Settings → Check for updates, on by default)
What is sent:
- None of your data. The app only downloads a public file (
hifilat.com/version.json) to compare with your installed version - Your IP address (visible to the server as in any web request)
What is NOT sent:
- No personal data, identifier, or usage information — this is not telemetry
You can turn it off in Settings → Check for updates. If it is off or there is no connection, the app works the same.
6. THERE ARE NO OTHER CONNECTIONS
The Software does NOT make any other network connection. In particular:
- ❌ There is no telemetry
- ❌ There are no analytics (Google Analytics, Mixpanel, etc.)
- ❌ There is no automated crash reporting
- ❌ There are no automatic updates (nothing installs itself; at most you are notified if a new version exists — see §5.3, can be turned off)
- ❌ There is no online license verification (100% local validation)
- ❌ There is no cloud synchronization
- ❌ No telemetry or sending of your data to hifilat.com. The only automatic connection to hifilat.com is the version check (§5.3): anonymous and able to be turned off. Other openings of hifilat.com are actions you initiate (the "HIFILAT.COM" link in the top bar and the "Buy" button), which open the site in your external browser without sending any of your data
You can verify this by inspecting the source code or monitoring network traffic with tools such as Little Snitch or Wireshark.
7. LEGAL BASIS FOR PROCESSING
When data protection regulations such as the GDPR apply, the applicable legal bases are:
- Performance of the contract (art. 6.1.b GDPR): providing the Software contracted by the user.
- Consent (art. 6.1.a GDPR): for queries to MusicBrainz and LRCLIB, which the user explicitly initiates.
- Legitimate interest (art. 6.1.f GDPR): for local error logs that the user controls.
8. COOKIES AND SIMILAR TECHNOLOGIES
The Software is a local desktop application that runs on localhost. It does not use tracking cookies, web beacons, advertising identifiers, or similar technologies.
The browser may store technical cookies necessary for the local session (page state), which are not transmitted to HIFILAT.
9. DATA RETENTION
| Data | Retention |
|---|---|
| Audio files and metadata | Indefinite — controlled by the user |
Settings (config.json) | Until the user deletes them |
License (license.key) | Until the user revokes it or the app is uninstalled |
Logs (hifilat.log) | Cumulative — the user can delete it manually |
Trial counter (trial.json) | Until a license is purchased or the file is deleted |
Metadata cache (library_index.db) | Until the user deletes it — it regenerates itself |
| In-RAM cache | Only during the app's execution |
| Data sent to MusicBrainz/LRCLIB | Subject to the retention policies of those services |
HIFILAT does not retain any user data on its own systems, because it has no systems that receive user data.
10. SECURITY
The Software implements the following technical measures to protect your data:
- Local bind: the server listens only on
127.0.0.1, not accessible from the network - Path traversal protection: strict path validation; files outside the authorized folders cannot be accessed
- AppleScript escape: injection prevention in system dialogs
- XSS protection: consistent escaping of all external data in the UI
- Timeout on external processes: ffmpeg and other subprocesses have a timeout to prevent hangs
Additionally, we recommend that the user:
- Keep their operating system updated
- Use strong passwords for their user account
- Make periodic backups of their music and settings
- Regularly review the logs (
hifilat.log) if they suspect abnormal activity
11. USER RIGHTS
Under the applicable data protection laws, you have the right to:
| Right | How to exercise it |
|---|---|
| Access | All the information is on your device — accessible through the file explorer (Finder) |
| Rectification | Edit the configuration files or the metadata directly |
| Erasure | Delete config.json, license.key, hifilat.log, trial.json, or library_index.db whenever you want |
| Restriction | Close the app or disable queries to external services by not using them |
| Portability | Your data is in open formats (JSON, plain text, FLAC) |
| Objection | Stop using the app |
Since HIFILAT does not process your data on its servers, there is no need to submit formal requests — you have full and direct control over the data that lives on your device.
Channel to exercise your rights: if you need to exercise any of these rights over data that HIFILAT does handle (for example, your email if you wrote to us or subscribed to our newsletter), write to contacto@hifilat.com; we will respond within the timeframes required by the applicable regulations.
Complaint to the authority: in Chile, you also have the right to file complaints with the Personal Data Protection Agency (Agencia de Protección de Datos Personales, the authority created by Law No. 21.719).
Automated decisions and profiling: HIFILAT does not make automated decisions or build profiles about users.
For data sent to MusicBrainz or LRCLIB, you must contact those services directly.
12. MINORS
The Software is not directed at minors. If you are under 18 years of age (or under the legal age in your jurisdiction), you must use the Software only under the supervision of a responsible adult.
We do not knowingly collect personal data from minors. If we detect that a minor has activated a license without adult authorization, we may suspend its use.
13. INTERNATIONAL TRANSFERS
Since HIFILAT does not collect data, we do not carry out international transfers as such. However, voluntary queries to:
- MusicBrainz: servers in Europe and the United States
- LRCLIB: servers outside Chile
involve international transfers under the user's direct control. These services have their own data protection safeguards.
Website and newsletter: if you contact us through the website form or subscribe to our newsletter, your email is handled through our email marketing provider (with servers outside Chile). That processing is governed by the Website Privacy Policy (https://hifilat.com), which complements this Software policy.
14. SECURITY INCIDENTS
If we become aware of a security vulnerability in the Software:
- We will publish a notice at https://hifilat.com
- We will release a corrected update as quickly as possible
- In the event of material impact, we will notify users through the available channels
If you discover a vulnerability, please report it responsibly to contacto@hifilat.com before disclosing it publicly.
15. MODIFICATIONS TO THIS POLICY
This Policy may be updated. Modifications will be notified through:
- An update to the "Last updated" field at the top of this document
- A prominent notice in the application upon opening it
- Publication at https://hifilat.com
Material changes require 15 days from notification to take effect. Minor changes (wording corrections, clarity) may be immediate.
16. CONTACT
For any inquiry related to this Privacy Policy or the processing of data:
- Email: contacto@hifilat.com
- Web: https://hifilat.com
17. ADHERENCE TO REGULATIONS
HIFILAT strives to comply with the applicable personal data protection regulations, including but not limited to:
- 🇨🇱 Law No. 19.628 of Chile on the Protection of Private Life
- 🇨🇱 Law No. 21.719 of Chile on the Protection of Personal Data (in force as of December 1, 2026). This Policy is structured to meet its duty-to-inform requirements (art. 14 ter) and incorporates the data subject's right to file complaints with the Personal Data Protection Agency.
- 🇪🇺 RGPD/GDPR — Regulation (EU) 2016/679
- 🇺🇸 CCPA — California Consumer Privacy Act
- 🇦🇷 Law 25.326 on the Protection of Personal Data (Argentina)
- 🇧🇷 LGPD — Lei Geral de Proteção de Dados (Brazil)
In jurisdictions with stricter regulations, the provisions most protective of the user will prevail.
18. LANGUAGE
The original version of this Policy is written in Spanish. Any translation into another language is provided for informational purposes only; in the event of a discrepancy, the Spanish version shall prevail.
© 2025–2026 HIFILAT SpA. All rights reserved.
Your music, your privacy, your control.